CVE-2022-48863

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48863
In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup pointer by kstrdup(cfg), but then it updates dup variable by strsep(&dup, "|"). As a result when it calls kfree(dup), the dup variable contains NULL. Found by Linux Driver Verification project (linuxtesting.org) with SVACE.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/640445d6fc059d4514ffea79eb4196299e0e2d0f Patch
https://git.kernel.org/stable/c/7777b1f795af1bb43867375d8a776080111aae1b Patch
https://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cb Patch
https://git.kernel.org/stable/c/c6a502c2299941c8326d029cfc8a3bc8a4607ad5 Patch
https://git.kernel.org/stable/c/640445d6fc059d4514ffea79eb4196299e0e2d0f Patch
https://git.kernel.org/stable/c/7777b1f795af1bb43867375d8a776080111aae1b Patch
https://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cb Patch
https://git.kernel.org/stable/c/c6a502c2299941c8326d029cfc8a3bc8a4607ad5 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Nov 2024, 07:34

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/640445d6fc059d4514ffea79eb4196299e0e2d0f - Patch () https://git.kernel.org/stable/c/640445d6fc059d4514ffea79eb4196299e0e2d0f - Patch
References () https://git.kernel.org/stable/c/7777b1f795af1bb43867375d8a776080111aae1b - Patch () https://git.kernel.org/stable/c/7777b1f795af1bb43867375d8a776080111aae1b - Patch
References () https://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cb - Patch () https://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cb - Patch
References () https://git.kernel.org/stable/c/c6a502c2299941c8326d029cfc8a3bc8a4607ad5 - Patch () https://git.kernel.org/stable/c/c6a502c2299941c8326d029cfc8a3bc8a4607ad5 - Patch

23 Jul 2024, 14:47

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/640445d6fc059d4514ffea79eb4196299e0e2d0f - () https://git.kernel.org/stable/c/640445d6fc059d4514ffea79eb4196299e0e2d0f - Patch
References () https://git.kernel.org/stable/c/7777b1f795af1bb43867375d8a776080111aae1b - () https://git.kernel.org/stable/c/7777b1f795af1bb43867375d8a776080111aae1b - Patch
References () https://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cb - () https://git.kernel.org/stable/c/a3d5fcc6cf2ecbba5a269631092570aa285a24cb - Patch
References () https://git.kernel.org/stable/c/c6a502c2299941c8326d029cfc8a3bc8a4607ad5 - () https://git.kernel.org/stable/c/c6a502c2299941c8326d029cfc8a3bc8a4607ad5 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: mISDN: corrige la pérdida de memoria en dsp_pipeline_build() dsp_pipeline_build() asigna el puntero dup mediante kstrdup(cfg), pero luego actualiza la variable dup mediante strsep(&dup, "|"). Como resultado, cuando llama a kfree(dup), la variable dup contiene NULL. Encontrado por el proyecto de verificación de controladores de Linux (linuxtesting.org) con SVACE.
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401

16 Jul 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-16 13:15

Updated : 2024-11-21 07:34

NVD link : CVE-2022-48863

Mitre link : CVE-2022-48863

CVE.ORG link : CVE-2022-48863

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime